In compliance, determining what is covered by a given standard: which devices, data, assets, personnel, and locations are subject to it. Legitimate and necessary, but can be abused to make a standard effectively meaningless.
Want to actually apply concepts like this instead of just reading definitions?
Practice free on Zamlom